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CLAIMS 

WE CLAIM: 

1 . A method of determining if a message is spam in a system having a 
plurality of anti-spam modules comprising the steps of: 

invoking a plurality of the plurality of anti-spam modules; 
receiving a spam confidence level from each of the plurality of the plurality of 
anti-spam modules; 

determining a highest spam confidence level from the spam confidence levels; 
comparing the highest spam confidence level to at least one threshold; and 
invoking an action associated with the at least one threshold if the highest spam 
confidence level is greater than the at least one threshold. 

2. The method of claim 1 further comprising the step of applying a tuning 
factor to at least one spam confidence level to create at least one tuned spam confidence 
level and wherein the step of determining a highest spam confidence level comprises the 
step of determining the highest of the at least one tuned spam confidence level and the 
spam confidence levels that had the tuning factor applied. • 

3. The method of claim 2 wherein the step of applying a tuning factor 
comprising tuning the at least one spam confidence level by a user's confidence level in 
the anti-spam module associated with the at least one spam confidence level. 
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4. The method of claim 1 further comprising the step of scaling each spam 
confidence level to a normalized range. 

5. The method of claim 4 wherein the normalized range is 0 to 9. 

6. The method of claim 1 further comprising the step of adding the spam 
confidence level to the message. 

7. The method of claim 1 wherein the at least one threshold comprises a 
plurality of thresholds including a top threshold and a bottom threshold, the method 
further comprising the steps of: 

comparing the highest spam confidence level to each of the plurality of 
thresholds; 

determining if the highest spam confidence level is higher than at least one of the 
plurality of thresholds; 

if the highest spam confidence level is higher than at least one of the plurality of 
thresholds: 

determining which of the at least one of the plurality of thresholds is closest to the 
top threshold; and 

invoking the action associated with the at least one of the plurality of thresholds 
that is closest to the top threshold. 



27 

8. The method of claim 1 wherein the step of invoking the action includes 
invoking one of deleting the message, sending a non-delivery notification, archiving the 
message, and passing the message to a client with the highest spam confidence level. 

9. The method of claim 1 wherein the step of invoking the action includes: 
dropping a connection if the highest spam confidence level exceeds a first 

threshold level; 

returning a non-delivery message to a sender if the highest spam confidence level 
exceeds a second threshold level and is below the first threshold level; 

delivering the message to a junk mail folder if the highest spam confidence level 
exceeds a third threshold level and is below the second threshold level. 

1 0. The method of claim 9 wherein the first threshold is a ninety nine percent 
spam confidence level, the second threshold is a seventy percent spam confidence level, 
and the third threshold level is a forty percent spam confidence level. 

1 1 . The method of claim 9 further comprising the step of logging the action 
taken with the message. 

12. A computer-readable medium having computer executable instructions for 
determining if a message is spam in a system having a plurality of anti-spam modules, the 
instructions comprising the steps of: 
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receiving a spam confidence level from each of a plurality of the plurality of anti- 
spam modules; 

determining a highest spam confidence level; 

comparing the highest spam confidence level to at least one threshold; and 
invoking an action associated with the at least one threshold if the highest spam 
confidence level is greater than the at least one threshold. 

13. The computer-readable medium of claim 12 having further computer- 
executable instructions for performing the step of applying a tuning factor to at least one 
spam confidence level to create at least one tuned spam confidence levels and wherein 
the step of determining a highest spam confidence level comprises the step of 
determining the highest of the at least one tuned spam confidence level and the spam 
confidence levels that had the tuning factor applied. 

14. The computer-readable medium of claim 13 wherein the step of applying a 
tuning factor comprising tuning the at least one spam confidence level by a user's 
confidence level in the anti-spam module associated with the at least one spam 
confidence level. 

15. The computer-readable medium of claim 12 having further computer- 
executable instructions for performing the step of scaling each spam confidence level to a 
normalized range. 
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16. The computer-readable medium of claim 15 wherein the normalized range 
is 0 to 9. 

17. The computer-readable medium of claim 12 having further computer- 
executable instructions for performing the step of adding the spam confidence level to the 
message. 

18. The computer-readable medium of claim 1 2 wherein the at least one 
threshold comprises a plurality of thresholds including a top threshold and a bottom 
threshold, the computer-readable medium having further computer-executable 
instructions for performing the steps of: 

comparing the highest spam confidence level to each of the plurality of 
thresholds; 

determining if the highest spam confidence level is higher than at least one of the 
plurality of thresholds; 

if the highest spam confidence level is higher than at least one of the plurality of 
thresholds: 

determining which of the at least one of the plurality of thresholds is closest to the 
top threshold; and 

invoking the action associated with the at least one of the plurality of thresholds 
that is closest to the top threshold. 
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19. The computer-readable medium of claim 12 wherein the step of invoking 
the action includes invoking one of deleting the message, sending a non-delivery 
notification, archiving the message, and passing the message to a client with the highest 
spam confidence level. 

20. The computer-readable medium of claim 12 wherein the step of invoking 
the action includes: 

dropping a connection if the highest spam confidence level exceeds a first 
threshold level; 

returning a non-delivery message to a sender if the highest spam confidence level 
exceeds a second threshold level and is below the first threshold level; 

delivering the message to a junk mail folder if the highest spam confidence level 
exceeds a third threshold level and is below the second threshold level. 

21 . The computer-readable medium of claim 20 wherein the first threshold is 
a ninety nine percent spam confidence level, the second threshold is a seventy percent 
spam confidence level, and the third threshold level is a forty percent spam confidence 
level. 

22. The computer-readable medium of claim 20 having further computer- 
executable instructions for performing the steps of logging the action taken with the 
message. 
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23. The computer-readable medium of claim 12 having further computer- 
executable instructions for performing the steps of invoking the plurality of the plurality 
of anti-spam modules. 

24. The computer-readable medium of claim 23 wherein the step of invoking 
the plurality of the plurality of anti-spam modules includes the step of providing a list of 
recipient addresses in the message. 

25. The computer-readable medium of claim 12 having further computer 
executable instructions for performing the step comprising cracking an encoded content 
of the message. 



